Microsoft Calms IE Bug Worries

Welcome Guest. | Log In| Register | Membership Benefits

August 22, 2005 (1:52 PM EDT)

By TechWeb Technology News

Microsoft on Monday continued to downplay the potential impact of last week's "zero-day" vulnerability in Internet Explorer, now by stressing the limited number of applications which use the flawed component.

According to a revamped security advisory on the Microsoft Web site, the affected COM object, Msdds.dll, is not added to a Windows system by default. It's actually only present when Microsoft Visual Studio 2002 and some versions of Microsoft Office applications have been installed.

"Customers who use the initial release of Microsoft Visual Studio 2002 are at risk from this vulnerability and are encouraged to apply Microsoft Visual Studio 2002 Service Pack 1," Microsoft stated in the updated advisory.

Other at-risk installations are Microsoft Office XP SP3 and Microsoft Access 2002 SP3.

Because Visual Studio 2002 is a development tool, it's unlikely run-of-the-mill business or home users will be vulnerable to an exploit of this Internet Explorer vulnerability. The bug in IE is due to a memory error caused when the browser calls on the Msdds.dll file as an ActiveX control. A successful exploit, which would be posted on a malicious Web site, could give the attacker complete control of the PC without any user interaction.

The revised advisory also offers a number of workarounds that users and enterprises can apply, including setting IE security to "high" and disabling the Msdds.dll file from running in IE.

Last week, the SANS Internet Storm Center posted a small free-of-charge utility that automatically "patched" the flaw by modifying the Windows registry.